I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so.

In other words, does SMIME encryption and/or signing cause a given email message to have more legal "power" than a message sent over TLS, PGP, DMARC, or similar technology such as an encrypted email portal?

For example, perhaps that a SMIME certificate has Low | Medium | High Assurance attribute embedded in the certificate; would that lower or raise the legal risk accordingly?

Q: Are there any precedents, or thought leaders that define when an email can be used in legal matters, and when not? In particular a "signed" message?

I found this post that might mean there is nothing to worry about, since non-repudiation in the computer-sciences sense is much different than a legal sense

There is a definitional distinction between the legal use of the term "non-repudiation" and its crypto-technical use. In the legal sense an alleged signatory to a document is always able to repudiate a signature that has been attributed to him or her [4]. The basis for a repudiation of a traditional signature may include:

  1. The signature is a forgery;
  2. The signature is not a forgery, but was obtained via:
    • Unconscionable conduct by a party to a transaction
    • Fraud instigated by a third party
    • Undue influence exerted by a third party

So if the

  • Non repudiation in electronic commerce. Does not sound like something that ages quickly. – Maarten Bodewes Jun 24 '14 at 22:49
  • You're asking a legal question. You'll need to consult a lawyer. Issues of repudiating a signature, forging of a signature, etc have a very long legal history. Remember that courts tend to see things straight-forwardly. When I was on an American jury, the judge instructed us that it was fine to make reasonable inferences based on our own experiences. Since criminal juries in the US must offer unanimous opinions, this works out fine. I think I did read of a case where the online signature system was organized so poorly that a person was able to repudiate it. – Larry K Jul 9 '14 at 9:24
up vote 3 down vote accepted
+150

If you are afraid of "snooping" then why would you use signatures ? A "snooper" is a passive eavesdropper, who wants to see the data but certainly not to make you aware that your emails are inspected. They won't alter emails, or send fake emails, which are the kind of things that signatures can help against.

If you want to defeat such sniffing, then you need to use end-to-end encryption. This will indirectly involved signatures, but on the certificates, not on the emails themselves. To prevent a man in the middle attack, you want to make sure that when you encrypt an email, you are using the true public key of the intended recipient -- that is where certificates and, crucially, signatures from CA, enter the mix. But these signatures predate the actual email; none of them makes any guarantee as to the email contents.


Now if you want to defeat active attackers, then indeed signatures become relevant. You will want to sign your emails so that the recipient may reliably detect whether your emails were altered in transit (this works, of course, only if the recipient expects your emails to be signed, and will suspect foul play if he receives an unsigned email allegedly sent by you).

At the legal level (though it depends a lot on the jurisdiction), all the "non-repudiation" thing is about shifting the burden of proof. An email, like any piece of data, can be used as proof during litigation; whether it is acceptable in that role depends on the context, and arguments which are then produced by both claimants. Basically, one party (let's call it A) will claim that the email really originates from the other party (B) and thus its contents "bind" B in some way (e.g. contractually); the other party (B) claims that the email is fake and was forged (by A or some other miscreant). Arguments include analysis of headers and log files on all involved machines (B's desktop system, email servers...) and possibly other elements (such as eye witnesses who saw B type the email, or other things like that).

What the legal framework that some countries are trying to build are ways to define the default interpretation: namely, is the email reputed genuine by default (and then B has to find good arguments showing the forgery), or is the email reputed unreliable by default (in which case A must do all the proof work) ? Digital signatures, in a cryptographic sense, can be a part of a system (both technical and legal) which, in some countries, will put the burden of proof on the forgery claimant ("B" in my example).

(As an illustration, in Hollywood, a handshake is considered a binding "signature" for a contract, without involving any computer or even any piece of paper with some ink on it. Eye witnesses are used if a dispute arises.)

Thus, signing emails incurs a "legal risk" only if you intend to renege on the email contents, and that legal risk is increased (with regards to an unsigned email) only within a context where you feel confident that you could successfully deny having sent an unsigned email. In practice, emails leave traces in many places when they hop from server to server, so reneging on some email is already "risky", regardless of whether the email was signed or not.


SSL/TLS, in the context of emails, is used mostly opportunistically. You may have it when sending the email to your outgoing SMTP server; recipient may use it when reading his mailbox (e.g. IMAPS, or some SSL-powered Webmail); SMTP servers may try to use SSL when talking to another SMTP server. Though SSL includes signatures, these are computed over technical "challenges" related to the SSL mechanisms, and do not cover the exchanged data. In that sense, SSL-level signatures cannot "technically" be used as proof about the data contents (this is authentication, not signature).

However, legal matters do not reduce to mere technical elements. The context rules. Some may argue, for instance, that generalized use of SSL for server-to-server connections makes it more difficult for outsiders to actually intercept the emails and alter them. So one may argue (specifically, may argue in court) that SSL tends to make forgeries harder. In any case, all this SSL happens for data transit only; intervening servers still see the email "as is" and maintain their log files, which appear to be sufficient to convince judges in practice.

The best defence strategy of a claimant who wants to renege on his emails might be to assert that his own computer is under control of some malware, which sent the email without his consent or even awareness. One may note that this defence "works" regardless of whether the email is signed or not, since the malware can use your private key to sign such forged emails.


To sum up: only an analysis of the complete situation can tell you whether your "legal risk" is impacted, in which direction and to what extent, by your signing your outgoing emails with S/MIME. However, one may surmise that, usually, S/MIME signatures don't change things much for the sender. For the recipient, signatures may lower the risk substantially in the following sense: if the recipient expects millions of incoming emails (e.g. the emails are actually registration contracts for some service), then he will realistically expect hundreds or even thousands of attempts at reneging emails. Generalized use of digital signatures may be expected to streamline the litigation process, thus lowering the involved costs.

If your enemy is the NSA, then all these legal talks are completely irrelevant: legal proofs are good only when you can show them to a judge. When you wake up, tied on an interrogation chair in the basement of some secret facility in South Dakota, there is no judge to talk to...

It very much depends on what you mean with "legal risks". For example in Europe there is something called a "qualified signature". If something, a document, email etc, is signed with a qualified signature, it has full legal binding. You cannot deny having signed it (at least the proof is on the signers side that he/she did not voluntarily signed the document). Of course not any digital signature qualifies as a qualified signature. The specific criteria are defined in Directive 1999/93/EC (for example the private key must be stored on an approved smart card, and the certificate can only be issued by approved CAs). A non qualified signature however does not imply that the signature is useless. Even an email without any signature has some legal binding. It's however not so easy to proof or disprove that someone sent or received an email. It's on the judge to decide. If however the email is also signed with a non qualified signature and you have always signed your email with this signature, then the proof that it was actually sent by the sender becomes stronger. The difference between a qualified and non qualified signature is that the qualified signature has full legal binding, there will not no discussion about the legality of the signature. The European qualified certificate directive is only valid in the EU. Other countries probably have similar laws.

Now back to your question, if you mean with "legal risk", the risk that you cannot deny having sent and email (non repudiation) then you should not sign it. If you mean that the recipient can deny that the email is from you, then you should sign the message. I therefore think you should first try to define what you mean the "legal risk".

For some easy to read background info on European qualified certificates see for example digital-signatures-and-european-laws

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.